Hypergate Cordova Sample

A minimal Apache Cordova app showing Kerberos single sign-on on Android with the Hypergate Cordova plugin and Hypergate Authenticator.

The app renders a single screen with an SPN input and a "Request token" button. On success it displays the Authorization: Negotiate <token> header value you would attach to an HTTP request.

For the full integration story, including how this fits into the NTLM deprecation, read Moving Your Android App off NTLM: Kerberos SSO with the Hypergate SDK.

Prerequisites

• Node.js (the Cordova CLI is installed as a dev dependency, use it via npx cordova)
• JDK 21, as required by cordova-android 15 (Gradle is provisioned automatically)
• Android SDK with platform 37 installed (the Hypergate SDK compiles against API 37) and an Android 7.0+ (API 24) device or emulator
• A managed device (supported EMMs) with Hypergate Authenticator deployed. Without it the token request fails with error 101 ("no accounts found"), which the app displays.

Build and run

npm install
npx cordova platform add android
npx cordova build android
npx cordova run android

Managed configuration

Token requests only succeed when your MDM/EMM/UEM pushes the right managed configurations:

Managed configuration	Value
Account type for HTTP Negotiate authentication (this app)	ch.papers.hypergate
Authentication server allowlist (this app)	* or an explicit domain list
Discoverability list (Hypergate Authenticator)	must include com.hypergate.cordovasample

How it works

Everything relevant lives in www/js/index.js:

window.Hypergate.getToken('HTTP@securedbackend.com', function (token) {
    // attach to your request: 'Authorization': 'Negotiate ' + token
}, function (error) {
    // no valid TGT, device not managed, or app not discoverable
});

Do not cache the token. Request a fresh one per API call, ideally in a request interceptor. For WebView-only apps you usually need no code at all: with the managed configurations above, the WebView authenticates every request transparently. See the plugin README for details.

Troubleshooting

• Error 101 ("no accounts found"): the app's package name is missing from the discoverability list in the Hypergate managed configuration, or the device has no Hypergate account at all.
• Token works but the backend returns 401: check that the SPN matches the backend's service principal and that the account behind it has AES key material (see the Kerberos RC4 removal post).

License

MIT, see LICENSE. Questions go to support@hypergate.com.